Avast Free Test failed

[system]

Hi,

I was running some tests on the Avast Free v17.3.2291 (I’ve just reinstalled it) and I tried to do these tests: https://www.avast.com/faq.php?article=AVKB32

However, the web shield worked. But the File System Shield did not worked. I have the component active. What could be wrong? I didn’t change any settings, it is out the box.

I have another question. Having an active firewall, it is necessary to have web shield active?

Thanks

[system]

To add another thing. The problem is the real time protection. If I scan the file manually, it detects.

[Pondus]

@dcop7 post:2

To add another thing. The problem is the real time protection. If I scan the file manually, it detects.

Then it is working.
Remeber this is just a text string, not a executable file so you cant test all functions

[system]

@Pondus post:3

Then it is working.
Remeber this is just a text string, not a executable file so you cant test all functions

The manual scan is working, but the real time protection apparently is not. In the Avast website there is a guide to test the real time protection (not manual scan). I’ve used the guide (again, from the Avast website) and it fails. How can I be sure that the real time projection is working since the test (provided by Avast) failed? Or the guide is wrong, or the real time projection is not working correctly.

[DavidR]

@dcop7 post:1

Hi,

I was running some tests on the Avast Free v17.3.2291 (I’ve just reinstalled it) and I tried to do these tests: https://www.avast.com/faq.php?article=AVKB32

However, the web shield worked. But the File System Shield did not worked. I have the component active. What could be wrong? I didn’t change any settings, it is out the box.

I have another question. Having an active firewall, it is necessary to have web shield active?

Yes it is absolutely necessary to have the web shield enabled. Your own test shows that, the web shield test worked and your firewall didn’t bat an eyelid. They are looking for completely different things.

@dcop7 post:2

To add another thing. The problem is the real time protection. If I scan the file manually, it detects.

You don’t say what eicar file was being tested ?
Some won’t be scanned by the file system shield immediately as they don’t present an immediate risk eicar.txt or eicar.zip for example. But the context (right click) menu scan will scan all files.

Without more information it is almost impossible to say what happened.

[system]

@DavidR post:5

You don’t say what eicar file was being tested ?
Some won’t be scanned by the file system shield immediately as they don’t present an immediate risk eicar.txt or eicar.zip for example. But the context (right click) menu scan will scan all files.

Without more information it is almost impossible to say what happened.

This is the guide I used: https://www.avast.com/faq.php?article=AVKB32#idt_02

The step 4 failed. I’ve download the file normally, I even try to open the file, but no alert pop-up appeared. It should appear a pop-up, like it is described on the step 4: “An alert pop-up message appears above the Avast orange-ball icon with the text Threat Blocked, which indicates that Avast 2016 real-time protection is working properly on your computer.”

[system]

It it helps, I have windows 10. I’ve uninstalled and reinstalled and still didn’t worked.

[DavidR]

Well I have just tested it using my system with 17.4.2292 (beta build) and the web shield off so it could be downloaded. I downloaded the http and https eicar.com files and no alert with the web shield off, which I expected. But no alert for new files being added to the system by the File System Shield.

Ordinarily I would expect the avast file system shield to scan a .com file, however it didn’t. But although it has a .com file extension it isn’t actually a .com file as it only has the eicar text string within the file, in effect just a text file.

Another hiccup (possibly), I have XP set to query the launch of all executable files and that stepped in before being able to run it.

I can only assume that avast is looking for the file type marker inside the file to indicate what file type it is rather than just look at the file name (which can easily be changed to fool users). This assumption needs clarification by avast.

[system]

@DavidR post:8

Well I have just tested it using my system with 17.4.2292 (beta build) and the web shield off so it could be downloaded. I downloaded the http and https eicar.com files and no alert with the web shield off, which I expected. But no alert for new files being added to the system by the File System Shield.

Ordinarily I would expect the avast file system shield to scan a .com file, however it didn’t. But although it has a .com file extension it isn’t actually a .com file as it only has the eicar text string within the file, in effect just a text file.

Another hiccup (possibly), I have XP set to query the launch of all executable files and that stepped in before being able to run it.

I can only assume that avast is looking for the file type marker inside the file to indicate what file type it is rather than just look at the file name (which can easily be changed to fool users). This assumption needs clarification by avast.

Thank you for your replication of the issue. Avast should scan the new file, but it didn’t. I hope avast could shed some light on this.

[Alikhan]

That is intentional behaviour:

@igor post:17

To make things faster (or rather to slow down the system less), some of the scans are postponed, they are not happening immediately.
So if you just write eicar to disk (and don’t do anything else with it), it may not be scanned right away, but rather later. If you touch the file again after writing, it should be scanned synchronously at that moment (if it was actually scheduled to be scanned).

[system]

@Alikhan post:10

That is intentional behaviour:

@igor post:17

To make things faster (or rather to slow down the system less), some of the scans are postponed, they are not happening immediately.
So if you just write eicar to disk (and don’t do anything else with it), it may not be scanned right away, but rather later. If you touch the file again after writing, it should be scanned synchronously at that moment (if it was actually scheduled to be scanned).

Two things:

• If this is normal behavior, the guide made by Avast is wrong.
• But, in the test I and DavidR made, we try to open the file and it didn’t alert it. It should detected when we try to open the file, right?

[Alikhan]

• But, in the test I and DavidR made, we try to open the file and it didn’t alert it. It should detected when we try to open the file, right?

That is correct.

[system]

@Alikhan post:12

That is correct.

So there is a problem with File System Shield?

[Alikhan]

@dcop7 post:13

@Alikhan post:12

That is correct.

So there is a problem with File System Shield?

Give me a few minutes, I’ll test it and escalate to the devs if there’s a problem but it could just be the file as DavidR has said.

[DavidR]

@dcop7 post:9

Thank you for your replication of the issue. Avast should scan the new file, but it didn't. I hope avast could shed some light on this.

You’re welcome.

1. Although my assumption needs clarification - avast will scan executable files that have had the file type changed to say a .txt file type as windows (I believe ) doesn’t rely on just the file type to see what should launch that file. If avast are doing this it is reasonable to believe they would do the same for .com files that are actually text files.

One thing for sure is it would be confusing for users if they start to run the eicar test.

2. As Alikhan mentions it is reasonable to delay the scan when it is written to disk (as it isn’t active), but you experienced more than that it didn’t scan it when executed (also confirmed on my system).

If this is the current practice then avast needs to change the avastUI > Component > File System Shield settings as this states ‘Scan files when writing’ (default enabled). When a file is saved to disk (download) it is written to disk, so a user would expect it to be scanned.

[Alikhan]

@igor post:5

If you have a 64bit OS (which I assume but don’t know), then there’s no “execute” of the eicar test file (because it’s a “COM”, old 16bit code and 64bit OSes doesn’t have the 16bit subsystem) - so eicar cannot be detected on execution on 64bit OSes. (So Eicar is not very useful as a test file these days.)

However, if you are able e.g. to copy an eicar.com file from one folder into another without any detection, then there’s something wrong here (just to be sure, I’d disable the “Optimize scanning during file copy option” in File System Shield Settings / Advanced).

@Vlk post:13

Yep. That’s because

• COM is not scanned on-open by default
• the execution of COM files is somewhat special (not really execution in the classical sense of Windows).

You can add COM to the list of custom files in the “Scan when opening” section, this should help.

Thanks
Vlk

[NON]

There were some discussions about Avast failing to detect eicar, below comments are from these (old) topics.

@dcop7, are you using 64bit Windows?
On that case, see below comment (same as Alikhan wrote):

@igor post:5

If you have a 64bit OS (which I assume but don’t know), then there’s no “execute” of the eicar test file (because it’s a “COM”, old 16bit code and 64bit OSes doesn’t have the 16bit subsystem) - so eicar cannot be detected on execution on 64bit OSes. (So Eicar is not very useful as a test file these days.)

However, if you are able e.g. to copy an eicar.com file from one folder into another without any detection, then there’s something wrong here (just to be sure, I’d disable the “Optimize scanning during file copy option” in File System Shield Settings / Advanced).

(Quoted from:
EICAR NOT DETECTED by File System Shield !?!?
https://forum.avast.com/index.php?topic=151146.msg1098104#msg1098104)

Even if you are using 32bit one, eicar sometimes cannot be detected, see this comment:

@Vlk post:13

Yep. That’s because

• COM is not scanned on-open by default
• the execution of COM files is somewhat special (not really execution in the classical sense of Windows).

You can add COM to the list of custom files in the “Scan when opening” section, this should help.

Thanks
Vlk

(Quoted from:
Eicar test fails on Avast Free
https://forum.avast.com/index.php?topic=64158.msg542311#msg542311)

[system]

@NON post:17

There were some discussions about Avast failing to detect eicar, below comments are from these (old) topics.

@dcop7, are you using 64bit Windows?
On that case, see below comment (same as Alikhan wrote):

@igor post:5

If you have a 64bit OS (which I assume but don’t know), then there’s no “execute” of the eicar test file (because it’s a “COM”, old 16bit code and 64bit OSes doesn’t have the 16bit subsystem) - so eicar cannot be detected on execution on 64bit OSes. (So Eicar is not very useful as a test file these days.)

However, if you are able e.g. to copy an eicar.com file from one folder into another without any detection, then there’s something wrong here (just to be sure, I’d disable the “Optimize scanning during file copy option” in File System Shield Settings / Advanced).

(Quoted from:
EICAR NOT DETECTED by File System Shield !?!?
https://forum.avast.com/index.php?topic=151146.msg1098104#msg1098104)

Even if you are using 32bit one, eicar sometimes cannot be detected, see this comment:

@Vlk post:13

Yep. That’s because

• COM is not scanned on-open by default
• the execution of COM files is somewhat special (not really execution in the classical sense of Windows).

You can add COM to the list of custom files in the “Scan when opening” section, this should help.

Thanks
Vlk

(Quoted from:
Eicar test fails on Avast Free
https://forum.avast.com/index.php?topic=64158.msg542311#msg542311)

Yes, I have 64bits Windows. I will try to copy the file from one folder to another and see. Thank you.

[DavidR]

@Alikhan post:16

@igor post:5

If you have a 64bit OS (which I assume but don’t know), then there’s no “execute” of the eicar test file (because it’s a “COM”, old 16bit code and 64bit OSes doesn’t have the 16bit subsystem) - so eicar cannot be detected on execution on 64bit OSes. (So Eicar is not very useful as a test file these days.)

However, if you are able e.g. to copy an eicar.com file from one folder into another without any detection, then there’s something wrong here (just to be sure, I’d disable the “Optimize scanning during file copy option” in File System Shield Settings / Advanced).

@Vlk post:13

Yep. That’s because

• COM is not scanned on-open by default
• the execution of COM files is somewhat special (not really execution in the classical sense of Windows).

You can add COM to the list of custom files in the “Scan when opening” section, this should help.

Thanks
Vlk

Thanks for digging this out - one thing for sure that FAQ https://www.avast.com/faq.php?article=AVKB32#idt_02 needs a complete upgrade as given what you have found makes it pretty much redundant. Other than the web shield getting involved, the rest the eicar.com tests are not worth

There are still a lot of people using 32bit OSes my XP Pro SP3 (test system) did execute (but lets say ran) so it should have detected the eicar string. My Win7 SP1 system is also 32bit. Only this win10 laptop is 64bit, but this system hasn’t been updated to avast 17.x.x

Perhaps avast should add .COM files to the list by default (or in an .ini file or behind the scenes), so users can run the set of eicar tests and get the expected results instead of a shock.

[system]

@NON post:17

There were some discussions about Avast failing to detect eicar, below comments are from these (old) topics.

@dcop7, are you using 64bit Windows?
On that case, see below comment (same as Alikhan wrote):

@igor post:5

If you have a 64bit OS (which I assume but don’t know), then there’s no “execute” of the eicar test file (because it’s a “COM”, old 16bit code and 64bit OSes doesn’t have the 16bit subsystem) - so eicar cannot be detected on execution on 64bit OSes. (So Eicar is not very useful as a test file these days.)

However, if you are able e.g. to copy an eicar.com file from one folder into another without any detection, then there’s something wrong here (just to be sure, I’d disable the “Optimize scanning during file copy option” in File System Shield Settings / Advanced).

(Quoted from:
EICAR NOT DETECTED by File System Shield !?!?
https://forum.avast.com/index.php?topic=151146.msg1098104#msg1098104)

Even if you are using 32bit one, eicar sometimes cannot be detected, see this comment:

@Vlk post:13

Yep. That’s because

• COM is not scanned on-open by default
• the execution of COM files is somewhat special (not really execution in the classical sense of Windows).

You can add COM to the list of custom files in the “Scan when opening” section, this should help.

Thanks
Vlk

(Quoted from:
Eicar test fails on Avast Free
https://forum.avast.com/index.php?topic=64158.msg542311#msg542311)

I’ve tried to copy the file to a folder to another and it didn’t detect anything. Also, I don’t have the option “Optimize scanning during file copy option” in File System Shield Settings / Advanced. I have (screenshot)